Results are for any subdomain, and are deduplicated (certificates and pre-certificates), covering only unexpired certificates.